Laura BellFounder and Lead Consultant - SafeStack@lady_nerd laura@safestack.io http://safestack.io

Testing outside

the digital

This talk might make you feel uncomfortable.

Sorry.

…I want you to feel uncomfortable

I like people

people are the path of least resistance

Inthistalk

TheProblem

Theneedforandlackofhumandefense

TheTool

WebuiltAVA…andwethinkyoumightlikeit

TheChallenges

Buildinghumansecuritysystemsishard…

we are comfortable when we talk about technical vulnerability

we do not empathise or sympathise with machines

They are inanimate objects.

technology is only part of the security picture

technology people process

technical systems are: reviewedscannedpenetration tested

processes are audited

what about people?

The problem with people

human vulnerability is natural

fear of rejection

fear of exposurefear of physical harm

fear of loss

love

humans are sufficiently predictableto make it suitably annoying when we fail to predict their behaviour.

an emergent behavior can appear when a number of simple entities operate in an environment, forming more complex behaviors as a collective.

The modern approaches

we live in the age of adversarial defense

we shame the human victims of human security attacks*

*while secretly doing the exact same things

we forget that we are a connected species

compliance has us racing to the bottom

we watch video training or e-learning

we make posters

we tick boxes

this is not how people learngo ask the education and psychology communities

It’s time for the age of collaborative defense

why don't we actively assess and test our human security risk?

we don't test because it’s too easy

people can’t be taught

people are lazy

people are stupid

s/people/we/g

we don't test

because it makes us feel uncomfortable

because we don't want people to get hurt

because it’s hardbecause we don’t know how to fix it

because we don't want people to get fired

border devices are not enough

AVA

Afirst generation proof of concept 3- phase automated human vulnerability scanner

KnowPHASE 1

We don’t know what our organisations look like

Human securityrisk ismagnified byconnection

Active DirectoryTwitterLinkedInFacebookEmail providers

PeopleIdentifiers

GroupsRelationships

Data

LocationTime stamps

SenderReceiver

User agent

friendscontacts

frequencyaliasesprofiles

Last loginPw Expires?

Disabled?Influence

Admin?

testPHASE 2

Threat injection and behaviour monitoring

Attack vectors that mean something

EmailSocial NetworksRemovable MediaFiles and honeypotsSMS

Email attacks that go beyond phishing

Email

phishing Internal request

social

panic

Direct request External request

favour

authoritative

TheURLmaybedifferentondifferentmessages.Subject:SecurityAlert:UpdateJava(*SeeKronosNote)Date:February22,2013************************************************************************Thisisanautomaticallygeneratedmessage.PleaseDONOTREPLY.Ifyourequireassistance,pleasecontacttheHelpCenter.************************************************************************OraclehasreleasedanupdateforJavathatfixes50securityholes,includingacriticalholecurrentlybeingexploitedinthewild.TheITSecurityOfficestronglyrecommendsthatyouupdateJavaas

User generated and publicly sourced attacks

Removing the boundaries between business and personal

Instant, scheduled and recurring

Security fails when it is treated like a special event

Give the option of succeedingand reinforce good behaviours

analysePHASE 3

Behaviour Vs. time

Measuring impact of training

And now for something a little bit different

Bridges, weak links and targeting

Pivotingand propagation

You know what would be fun?

Predictive risk behaviour analysis

The challenges

a public interest security tool

….from everyone

success requires engagement

is this even legal?

The law in this space is immature

publically availablepreviously knownalready published

can we assess human vulnerability on this scalecompromising the privacy the people we assess?

Privacy is about protecting people

Know

Update

Delete

Ask

yeah, if you could just give me access to all the information you have…that’d be great

No.

AVA Ethics and Privacy BoardObjective, Representative, Independent, Collaborative

new members welcome to apply

Open. Honest. Plain English

Is this technically possible?

Building new things is hard

Scale that has to be visible

There is a reason why compromised email accounts have value

Can we simulate attack aliases in a manageable way?

Won’t somebody think of the test data

Integration

GoogleFacebook

TwitterLinkedin

MicrosoftSlack

GitHub

If you are reading this and work for these places, we should probably talk.HINT HINT

TL;DR

Wehaveapeopleproblem

Attackerswillchoosethepathofleastresistanceandwearenotprepared

AVAisanearlyalphaprototype

Wewantafutureofcontinuoushumanvulnerabilityassessment

Theroadaheadishard

Privacy,ethics,momentum,security, scalingandmuchmore

Laura BellFounder and Lead Consultant - SafeStack@lady_nerd laura@safestack.io http://safestack.io

Questions?#protectyourpeople